JP2022109737A - Abnormality detection method, and abnormality detection apparatus - Google Patents

Abstract

To properly carry out detection of any abnormality with suppressing the number of models to be generated.SOLUTION: An abnormality detection method includes: a step (S201) of acquiring a model for outputting a first index indicating a degree of deviation of an operation indicated by first data from a normal operation, by using, as an input, the first data indicating an operation of an apparatus, acquiring a statistic value for each set of parameter values of second indexes output by the model by using, as an input, each of a plurality of second data each indicating the operation of the apparatus and associated with the set of the parameter values of the apparatus obtained during the operation, and acquiring third data indicating the operation of the apparatus and associated with the set of the parameter values of the apparatus obtained during the operation; a step (S202) of acquiring a third index output by the model by using the acquired third data as an input; and a step (S203) of, by using comparison of the acquired third index with the statistic value for the set of the parameter values associated with the acquired third data, generating information regarding abnormality in operation indicated by the third data to output it.SELECTED DRAWING: Figure 11

Description

The present disclosure relates to an anomaly detection method and an anomaly detection device.

2. Description of the Related Art Conventionally, there is a technology that detects the posture or motion state of a subject and contributes to health management or disease prevention (see Patent Document 1).

JP 2016-150102 A

However, according to the technique described in Patent Document 1, the number of discriminative models (simply referred to as models) to be generated may increase. If the number of models to be generated increases, the processing required to generate the models increases, and the power consumption required for the processing to generate the models increases.

Accordingly, the present disclosure provides an anomaly detection method and the like that appropriately perform anomaly detection while suppressing the number of models to be generated.

An anomaly detection method according to the present disclosure obtains a model that receives first data indicating the operation of a device as input and outputs a first index indicating the degree to which the operation indicated by the first data deviates from normal operation. , each of which is a plurality of second data, each of which indicates an operation of the device, and which is associated with a set of parameter values of the device during the operation, the model Acquiring statistical values for each set of the output second indicators, indicating the operation of the device, and acquiring and acquiring third data associated with the set of parameter values of the device during the operation obtaining the third index output by the model using the obtained third data as input, and obtaining the statistical value for the set of parameter values associated with the obtained third index and the obtained third data; is an abnormality detection method for generating and outputting information regarding an abnormality in the operation indicated by the third data, using the comparison of .

According to the above aspect, the statistical values of the second index output by the model are obtained in advance for each of the plurality of sets of parameter values, and then the index of the third data, which is the operation data input to the model, is obtained as the second index. Anomaly information is generated by comparing statistical values for sets of parameter values during operation of the device related to the three data. If a model were prepared for each set of parameter values, the number of required models would increase, and the processing and power consumption required to generate the models would also increase. In addition, if the statistical values of the second index output by the model are not used for each of a plurality of sets of parameter values, differences in operation data will occur due to different sets of parameter values. may not be able to generate information about the anomaly. According to the anomaly detection method of the present disclosure, the statistic value for the set of parameter values related to the third data, which is included in the statistic value of the second index for each of the plurality of sets of parameter values; Since the indices are used, a model for each set of parameter values is not required, and differences in operation data caused by different parameters can be suppressed. In this way, the anomaly detection method according to the present disclosure appropriately performs anomaly detection while reducing the number of models to be generated.

Further, when comparing the third index with the statistical value for the set of parameter values, whether or not the value obtained by subtracting the statistical value from the obtained third index is equal to or greater than a predetermined threshold. If it is determined that the value is equal to or greater than the predetermined threshold, the information including information indicating that there is an abnormality is generated, and the value is less than the predetermined threshold. When determined, the information including information indicating that there is no abnormality may be generated.

According to the above aspect, by subtracting the statistic value from the third index, the difference in the operation data caused by the different sets of parameter values is suppressed, and based on the third index after the subtraction, Generate information indicating the presence or absence of anomalies. Therefore, while suppressing the number of models to be generated, detection of anomalies can be performed more easily and appropriately.

Further, when acquiring the model, in the data space, among a plurality of pieces of learning data each including the operation of the device, a cluster containing a predetermined proportion of mutually similar learning data is generated, and the generated The model may be obtained by generating a model that outputs, as the first index, a distance from the center of gravity of the plurality of learning data included in the cluster.

According to the above aspect, the operation data indicating the normal operation of the device is generated by clustering a plurality of pieces of operation data for model generation, and the distance between the operation related to the input operation data and the normal operation in the data space is calculated. is used to output the degree of divergence from the normal motion of the motion associated with the input motion data. Therefore, while suppressing the number of models to be generated, detection of anomalies can be performed more easily and appropriately.

Further, when obtaining the model, generating the cluster using unsupervised learning may be used to obtain the model.

According to the above aspect, the clustering process is performed on the learning data by unsupervised learning. Therefore, while suppressing the number of models to be generated, unsupervised learning is used to more accurately and appropriately detect anomalies.

Further, the first data indicates an operation of the device for a predetermined length of time, each of the plurality of second data indicates the operation of the device for the predetermined length of time, The third data may indicate operation of the device for the predetermined length of time.

According to the above aspect, the operation data related to the operation of the device for a predetermined length of time is used as the operation data, so that the operation data can be handled and processed more easily. Therefore, while suppressing the number of models to be generated, detection of anomalies can be performed more easily and appropriately.

Further, the third data includes the third data in each of the plurality of periods each having the predetermined time length, and the model outputs the plurality of the acquired third data as input. obtaining the third index for each of the third data, and using the average value of the plurality of obtained third indexes and the statistical value for the set of parameter values associated with the third data; , and may generate and output information about the abnormality in the operation indicated by the third data.

According to the above aspect, it is possible to obtain information about an abnormality in the device by taking into consideration operation data relating to the operation of the device in a plurality of periods. As a result, it may be possible to discover an abnormality in the device that cannot be discovered from only the operation data in one period. Therefore, while suppressing the number of models to be generated, detection of anomalies can be performed more appropriately.

Also, the plurality of periods may be consecutive periods.

According to the above aspect, it is possible to acquire information about an abnormality in the device by considering the operation data related to the operation of the device in a plurality of consecutive periods. As a result, it may be possible to discover an abnormality in the device that cannot be discovered from only the operation data in one period. Therefore, while suppressing the number of models to be generated, detection of anomalies can be performed more appropriately.

The device is an air conditioner, and the parameter values include information indicating the timing of the operation, information indicating the mode of operation, information indicating whether or not the setting of the operation has been changed, and information indicating whether or not the setting of the operation has been changed. It may contain information indicating the operating state of the compressor.

According to the above aspect, for the air conditioner, information indicating the operation timing, information indicating the operation mode, information indicating whether or not the operation setting has been changed, and information indicating the operating state of the compressor of the air conditioner are used. to output information about an air conditioner abnormality. Therefore, while suppressing the number of models to be generated, the abnormality of the air conditioner is appropriately detected.

An anomaly detection device according to the present disclosure is an anomaly detection device including an acquisition unit, a generation unit, and a detection unit, wherein the acquisition unit inputs first data indicating the operation of a device, Obtaining a model that outputs a first index indicating the degree to which the indicated action deviates from normal action, wherein the generating unit is a plurality of second data, each of which indicates the action of the device; Acquiring a statistical value for each set of the second index output by the model with each of a plurality of second data associated with a set of parameter values of the device during operation as input, acquires third data indicating the operation of the device and associated with a set of parameter values of the device at the time of the operation, and the detection unit uses the acquired third data as input to generate the model obtains the third index output by, and compares the obtained third index with the statistical value for the set of parameter values associated with the obtained third data, the third data is an anomaly detection device for generating and outputting information about an anomaly in the operation shown in .

According to the above aspect, the same effects as those of the abnormality detection device can be obtained.

In addition, these generic or specific aspects may be realized by a system, device, integrated circuit, computer program, or a recording medium such as a computer-readable CD-ROM. and any combination of recording media.

The anomaly detection method of the present disclosure can appropriately perform anomaly detection while reducing the number of models to be generated.

FIG. 1 is an explanatory diagram showing the configuration of the detection system according to the embodiment. FIG. 2 is a block diagram showing the functional configuration of the abnormality detection device according to the embodiment. FIG. 3 is an explanatory diagram showing inputs and outputs of the model according to the embodiment. FIG. 4 is an explanatory diagram showing the time length of motion data according to the embodiment. FIG. 5 is an explanatory diagram of scores output by the model according to the embodiment. FIG. 6 is an explanatory diagram showing operating parameters of the device according to the embodiment. FIG. 7 is an explanatory diagram showing the concept of calculating the median score for each set of parameter values according to the embodiment. FIG. 8 is an explanatory diagram illustrating an example of the median score for each set of parameter values according to the embodiment. FIG. 9 is an explanatory diagram showing the concept of calculation of the adjusted score of motion data according to the embodiment. FIG. 10 is a flow diagram showing processing for obtaining statistical values of scores for each set of parameter values according to the embodiment. FIG. 11 is a flowchart showing processing for generating and outputting abnormality information according to the embodiment. FIG. 12 is an explanatory diagram showing the concept of calculating integrated scores in a plurality of periods according to the modification of the embodiment.

Hereinafter, embodiments will be described in detail with reference to the drawings as appropriate. However, more detailed description than necessary may be omitted. For example, detailed descriptions of well-known matters and redundant descriptions of substantially the same configurations may be omitted. This is to avoid unnecessary verbosity in the following description and to facilitate understanding by those skilled in the art.

It is noted that the inventors provide the accompanying drawings and the following description for a full understanding of the present disclosure by those skilled in the art and are not intended to limit the claimed subject matter thereby. do not have.

Hereinafter, the background leading to the present invention and the problems to be solved by the present invention will be described in detail, and then the embodiments will be described.

2. Description of the Related Art Conventionally, there is a technology that detects the posture or motion state of a subject and contributes to health management or disease prevention (see Patent Document 1).

Specifically, the technique according to Patent Literature 1 generates a plurality of models based on machine learning from acceleration information and biosignal information measured by a wearable device.

However, according to the technique described in Patent Document 1, the number of models to be generated may increase. If the number of models to be generated increases, the processing required to generate the models increases, and the power consumption required for the processing to generate the models increases.

In general, there is also a technique for detecting an abnormality in an electrical device (simply referred to as a device) based on data (also referred to as operation data) indicating the operation of the device. In such a technique, when the operation data of the device changes according to the parameter value related to the operation of the device, the difference in the operation data of the device caused by the difference in the parameter value is detected as an abnormality of the device. Sometimes.

In order to avoid such detection, it is assumed to prepare models according to parameter values. However, as the parameter values increase, a model must be prepared for each set of parameter values, which can increase the number of models to be generated. If the number of models to be generated increases, the same problem as described above may arise in that the processing required to generate the models increases, and the power consumption required for the processing to generate the models increases.

Therefore, the present disclosure provides an anomaly detection method and the like that appropriately perform anomaly detection while suppressing the number of identification models to be generated.

(Embodiment)
In the present embodiment, an anomaly detection device that appropriately performs anomaly detection while suppressing the number of models to be generated will be described.

FIG. 1 is an explanatory diagram showing the configuration of an anomaly detection system 1 according to this embodiment. The anomaly detection system 1 is an anomaly detection system that appropriately performs anomaly detection while suppressing the number of models to be generated.

As shown in FIG. 1 , the anomaly detection system 1 includes an anomaly detection device 10 , an air conditioner 5 and a presentation device 7 . The abnormality detection device 10, the air conditioner 5, and the presentation device 7 are connected via a network N so as to be able to communicate with each other.

The abnormality detection device 10 is an abnormality detection device that executes detection processing regarding an abnormality in the air conditioner 5 . The abnormality detection device 10 acquires operation data, which is data indicating the operation of the air conditioner 5 . The abnormality detection device 10 has a model for detecting abnormality of the air conditioner 5 , and executes detection processing regarding abnormality of the air conditioner 5 by inputting the acquired operation data into the model. As a result of the detection process, the abnormality detection device 10 generates information about the abnormality of the air conditioner 5 and provides the information to the presentation device 7 . Detailed processing of the abnormality detection device 10 will be described in detail later.

The air conditioner 5 is an example of an electrical device (simply referred to as a device) used in the home of the user U. Instead of the air conditioner 5, other equipment (for example, refrigerator, washing machine, etc.) may be used.

The air conditioner 5 has a plurality of parameters regarding operation. For example, the parameters include information indicating the time of operation, information indicating the mode of operation, information indicating whether or not the setting of operation has been changed, and information indicating the operating state of the compressor provided in the air conditioner 5. A specific value set to a parameter is also called a parameter value.

Also, the air conditioner 5 generates operation data indicating the operation of the air conditioner 5 and transmits the operation data to the abnormality detection device 10 . The operation data is data indicating the operation within a period having a predetermined length of time (for example, about 5 to 10 minutes) when the air conditioner 5 operates. The operation data includes, for example, information such as the set temperature when the air conditioner 5 is in operation, the state of the power supply, and sensor information (for example, the temperature of the pipes or the number of revolutions of the fan motor).

The presentation device 7 is a device that acquires information about an abnormality of the air conditioner 5 from the abnormality detection device 10 and presents it. The presentation device 7 presents the information about the abnormality of the air conditioner 5 acquired from the abnormality detection device 10 by displaying it as an image on a display screen or outputting it as sound from a speaker. It is assumed that the information about the abnormality of the air conditioner 5 presented by the presentation device 7 is visually recognized by a maintenance person V (or a supervisor) who remotely maintains the air conditioner 5, a user U of the air conditioner 5, or the like.

FIG. 2 is a block diagram showing the functional configuration of the abnormality detection device 10 according to this embodiment.

As shown in FIG. 2 , the anomaly detection device 10 includes an acquisition unit 11 , a generation unit 12 , a storage unit 13 and a detection unit 14 . The acquisition unit 11, the generation unit 12, and the detection unit 14 are configured such that a processor (for example, a CPU (Central Processing Unit)) (not shown) included in the anomaly detection device 10 executes a predetermined program using a memory (not shown). It can be realized by executing The storage unit 13 can be realized by a storage device, specifically a volatile storage device memory such as a RAM (Random Access Memory), or a non-volatile storage device such as a HDD (Hard Disk Drive).

The acquisition unit 11 is a functional unit that acquires operation data and a model indicating the operation of the air conditioner 5 .

The motion data acquired by the acquisition unit 11 includes a plurality of motion data (also referred to as adjustment data) used to acquire statistical values of the score for each set of parameter values, and motion data targeted for abnormality detection (target data Also called) and. The adjustment data corresponds to the second data. Target data corresponds to third data.

The model acquired by the acquisition unit 11 is obtained by inputting operation data (corresponding to first data) indicating the operation of the air conditioner 5, and obtaining a score indicating the degree to which the operation indicated by the first data deviates from the normal operation of the air conditioner 5. (corresponding to the first index).

After acquiring the plurality of adjustment data, the acquisition unit 11 provides the acquired plurality of adjustment data to the generation unit 12 . After acquiring the target data, the acquisition unit 11 provides the acquired target data to the detection unit 14 . After obtaining the model, the obtaining unit 11 stores the obtained model as the model 16 in the storage unit 13 .

The generation unit 12 is a functional unit that generates reference information using a plurality of pieces of adjustment data. Each of the plurality of adjustment data acquired by the acquisition unit 11 indicates the operation of the air conditioner 5 and is associated with a set of parameter values during the operation of the air conditioner 5 . The generation unit 12 acquires the statistical value by calculating the statistical value for each set of parameter values of the score (also referred to as the adjustment score) output by the model 16 with each of the plurality of adjustment data as input. . The statistic value for each set of score parameter values is a numerical value obtained by statistical processing of scores, such as the median value, mean value, or mode value. Hereinafter, a case where the median value is used as the statistical value will be described as an example. The generation unit 12 stores the acquired statistical value in the storage unit 13 as the reference information 17 . The adjustment score corresponds to the second index.

The storage unit 13 is a storage device that stores the model 16 and the reference information 17 . The model 16 is stored by the acquisition unit 11 and read by the generation unit 12 and the detection unit 14 . The reference information 17 is stored by the generator 12 and read by the detector 14 .

The detection unit 14 is a functional unit that generates and outputs information regarding an abnormality in the operation of the air conditioner 5 .

The detection unit 14 receives the target data acquired by the acquisition unit 11 and acquires a score output by the model 16 (also referred to as a target score). Then, the detection unit 14 compares the acquired target score with the statistical value of the set of parameter values associated with the acquired target data, and determines whether the abnormality in the operation of the air conditioner 5 indicated by the target data is detected. It generates information (also called anomaly information) and outputs the generated anomaly information. The target score corresponds to the third score.

When generating anomaly information, the detection unit 14 compares a value obtained by subtracting the statistical value from the obtained target score with a predetermined threshold, so that the value obtained by subtracting the statistical value from the obtained target score is a predetermined value. is greater than or equal to the threshold value. When it is determined that the value is equal to or greater than a predetermined threshold value, abnormality information including information indicating an abnormality is generated, and when it is determined that the value is less than the predetermined threshold value generates anomaly information including information indicating that there is no anomaly.

The first data may indicate the operation of the air conditioner 5 for a predetermined length of time. Moreover, each of the plurality of second data may indicate the operation of the air conditioner 5 for a predetermined length of time. Also, the third data may indicate the operation of the air conditioner 5 for a predetermined length of time.

Hereinafter, processing executed by the abnormality detection device 10 will be described in more detail.

FIG. 3 is an explanatory diagram showing inputs and outputs of the model 16 according to this embodiment. FIG. 4 is an explanatory diagram showing the time length of motion data according to the present embodiment. FIG. 5 is an explanatory diagram showing scores output by the model 16 according to this embodiment.

As shown in FIG. 3, the model 16 is a model that acquires operation data of the air conditioner 5 as input and outputs a score corresponding to the input operation data.

For example, examples of operational data input to model 16 are data D1 and D2 (also referred to as D1, etc.). The model 16 receives data D1, which is motion data, as an input, and outputs a score S1, which is a score corresponding to the data D1. Similarly, the model 16 receives data D2, which is motion data, as an input, and outputs a score S2, which is a score corresponding to the data D2.

Here, the data D1, etc. are operation data indicating the operation of the air conditioner 5 during periods T1, T2, etc. having a predetermined time length t (see FIG. 4). The predetermined time length t is, for example, about 5 to 10 minutes.

In FIG. 4, the data D2 is the operation data for the period T2 immediately after the period T1 in which the data D1 is obtained, but the relationship between the periods T1 and T2 is not limited to this. For example, the period T2 may be set after an appropriate time interval after the period T1.

The scores output by the model 16 will be described in detail with reference to FIG.

The model 16 outputs the degree of deviation of the input data D1 from the plurality of motion data as a score. The plurality of operational data includes operational data when the air conditioner 5 actually operates with various sets of parameter values. Among the plurality of operation data mentioned above, the operation data during normal operation of the air conditioner 5 and the operation data during abnormal operation are included without distinction, but the majority (for example, about 90% or more) are included. is assumed to be operational data during normal operation.

In general, the air conditioner 5 operates normally for a relatively long time and operates abnormally for a relatively short time. The reason for this is that when the air conditioner 5 starts to operate abnormally, the user U notices the fact and the air conditioner 5 is repaired, and in many cases, the air conditioner 5 returns to normal operation. Moreover, if the abnormality of the air conditioner 5 is serious, the operation cannot be continued and the operation is stopped, and the operation data is not generated.

Therefore, the score output by the model 16 (that is, the degree to which the input data D1 deviates from the plurality of stored operation data) is determined by the operation of the air conditioner 5 indicated by the input data D1. It can be said that it indicates the degree of divergence from the normal operation of 5.

The model 16 will be specifically described using the data space with reference to FIG.

In FIG. 5, a data space with axes A and B is shown. Axis A and axis B respectively correspond to information included in data D1 and the like. In FIG. 5, a two-dimensional data space is expressed using two axes for convenience of explanation, but in reality, a multi-dimensional data space can be expressed using more axes.

In FIG. 5, a plurality of motion data used to generate the model 16 are indicated by square symbols. The plurality of operational data includes operational data when the air conditioner actually operates with various sets of parameter values. The air conditioners that operate according to the operation data may include a plurality of air conditioners of the same or similar models as the air conditioner 5 . A similar model means an air conditioner manufactured by the same manufacturer as the air conditioner 5, an air conditioner having the same mechanism as the air conditioner 5, an air conditioner belonging to the same product series as the air conditioner 5, and the like. Note that the plurality of air conditioners may or may not include the air conditioner 5 .

When the model 16 is generated, first, clusters to which the majority (for example, about 90%) of the plurality of motion data belong are generated. In FIG. 5, a plurality of pieces of motion data included in frame C correspond to the clusters.

The model 16 also derives the center of gravity G in the data space of the plurality of motion data included in the generated cluster. The center of gravity G is indicated by a circle symbol in FIG. The center of gravity G is average operation data of a large number of mutually similar operation data included in the plurality of operation data, and can be said to be operation data of normal operation of the air conditioner 5 .

When the model 16 acquires data D1 as an input, for example, the model 16 calculates the distance d between the center of gravity G and the data D1 in the data space as a score. Data D1 is indicated by a triangular symbol in FIG. The calculated distance d, that is, the score, indicates the degree to which the operation indicated by the data D1 deviates from the normal operation of the air conditioner 5. FIG.

The process of generating clusters in the data space can be performed, for example, by unsupervised learning of learning data, more specifically by agglomerative clustering.

That is, when acquiring the model 16, in the data space, among a plurality of pieces of learning data each including the operation of the air conditioner 5, a cluster containing a predetermined proportion of mutually similar learning data is generated, and the generated cluster The model 16 can be obtained by generating the model 16 that outputs the distance from the center of gravity of the plurality of learning data contained in as a score.

The parameters are described below.

FIG. 6 is an explanatory diagram showing parameters of the air conditioner 5 according to this embodiment. It is assumed that the parameters of the air conditioner 5 are associated with the operation data of the air conditioner 5 . In other words, the operation data of the air conditioner 5 is associated with the parameters of the air conditioner 5 during the period in which the operation data was acquired.

FIG. 6 shows, as parameters of the air conditioner 5, information indicating "time", "mode", "presence/absence of setting change", and "compressor state".

“Timing” is information indicating when the air conditioner 5 operates. The time is information indicating the timing at which the air conditioner 5 is operating, such as the season, month, day, and hour. FIG. 6 shows an example in which summer and winter are used as time parameter values.

“Mode” is information indicating the operation mode of the air conditioner 5 . Modes can be set to cooling, heating, dehumidification, and the like. FIG. 6 shows an example in which cooling and heating are used as mode parameter values.

"Whether settings have been changed" indicates whether the settings of the air conditioner 5 have been changed ("yes" in the figure) or have not been changed ("no" in the figure) during the period when the operation data was acquired. This is the information shown. FIG. 6 shows an example in which "yes" and "no" are used as parameter values indicating the presence or absence of setting changes.

“Compressor state” is information indicating the operating state (for example, ON or OFF) of the compressor of the air conditioner 5 during the period when the operating data was acquired. FIG. 6 shows an example in which "ON" and "OFF" are used as the parameter values of the state of the compressor.

FIG. 6 shows 16 sets of parameter values, with various parameter values set for each of the above four parameters. "Set No" is a serial number attached to a set of parameter values. Hereinafter, a set of parameter values whose set number is 1 will be referred to as "set 1". The same is true for other sets of parameter values.

For example, set 1 is a set of parameter values indicating that the season is summer, the mode is cooling, the setting is changed during the period, and the compressor is ON.

Set 2 is a set of parameter values indicating that the season is summer, the mode is cooling, the setting is changed during the period, and the compressor is OFF.

The same is true for sets of parameter values from set 3 to set 16 .

FIG. 7 is an explanatory diagram showing the concept of calculating the median score for each set of parameter values according to the present embodiment. FIG. 8 is an explanatory diagram showing an example of the median score for each set of parameter values according to the present embodiment.

Calculation of the median shown in FIG. 7 is performed by the generator 12 .

As shown in FIG. 7, the model 16 is input with motion data associated with each of a plurality of sets of parameter values. In FIG. 7, sets 1 and 2 are shown as multiple sets of parameter values. Data D11 and D12 are shown as operation data associated with set 1 . Data D21 and D22 are shown as operation data associated with set 2. FIG. Note that the motion data associated with set 1 or 2 is not limited to the above, and may be other.

The generating unit 12 acquires the score output by the model 16 with respect to the motion data input to the model 16 . Specifically, the generation unit 12 receives the data D11 and D12, which are motion data, and acquires the score S11 and the score S12 output by the model 16 . Similarly, the generation unit 12 receives the data D21 and D22, which are motion data, and acquires the score S21 and the score S22 output by the model 16 .

Furthermore, the generation unit 12 calculates the median value of the scores S11 and S12 in association with the set 1 . The generation unit 12 also calculates the median value of the scores S21 and S22 in association with the set 2 .

Thus, it can be said that the median value calculated in association with the set of parameter values indicates the average score of the operation data when the air conditioner 5 operates with the set of parameter values.

The generation unit 12 calculates the median score of all parameter value sets (that is, sets 1 to 16) shown in FIG. 6, and stores it in the storage unit 13 as the reference information 17 (see FIG. 8).

In FIG. 8, the median score of sets 1 to 4 is relatively small, and the median score of sets 5 to 8 is relatively large. This feature is explained as follows.

The score indicates the difference between the operation according to the operation data input to the model 16 and the majority of operations of the air conditioner 5, as described above. For example, it can be said that the majority of operations in the summertime are to operate the air conditioner 5 in the cooling operation mode, for example. Sets 1 to 4 in FIG. 8 correspond to operating the air conditioner 5 in the cooling operation mode in the summer season, in other words, they correspond to the majority of operations of the air conditioner 5 . Therefore, a relatively small value is obtained as the median score for Sets 1-4.

On the other hand, sets 5 to 8 in FIG. 8 correspond to operating the air conditioner 5 in the heating mode of operation during the summer season, in other words different from the operation of the majority of the air conditioners 5 . Therefore, a relatively large value is obtained as the median score for Sets 5-8.

FIG. 9 is an explanatory diagram showing the concept of calculation of the adjusted score of motion data according to the present embodiment.

Calculation of the adjusted score shown in FIG. 9 is performed by the detection unit 14 on the target data acquired by the acquisition unit 11 .

The detection unit 14 receives the data D3, which is the target data acquired by the acquisition unit 11, and acquires the score S3, which is the target score output by the model 16. FIG. Further, the detection unit 14 acquires a set of parameter values associated with the target data acquired by the acquisition unit 11 .

Next, the detection unit 14 selects the median value of the parameter value pairs associated with the data D3, which is the target data, from among the median values of the parameter value pairs included in the reference information 17. get.

Then, the detection unit 14 obtains an adjusted score S4 by subtracting the median value of the set of parameter values associated with the data D3 from the score S3 (see (Formula 1)).

Adjusted Score S4 = Score S3 - Median (Equation 1)

As in (Formula 1), by subtracting the median value, that is, the average score of the operation data of the air conditioner 5 related to the data D3, from the score S3, the adjusted score S4 is the parameter associated with the data D3. It can be said that it is an index indicating the magnitude of the score S3 based on the average score for the set of .

As a result, in the adjusted score S4, the score difference due to the difference in the parameter value set is suppressed, and the air conditioner 5 related to the data D3 is compared with the operation data associated with the same parameter value set. It is a score that reflects the quality of the movement.

Processing executed by the abnormality detection device 10 will be described below. A process of acquiring statistical values of scores for each set of parameter values and a process of generating and outputting abnormality information, which are executed by the abnormality detection device 10, will be described.

FIG. 10 is a flow chart showing processing for acquiring statistical values of scores for each set of parameter values according to the present embodiment.

As shown in FIG. 10, the acquisition unit 11 acquires the model 16 in step S101.

In step S<b>102 , the acquisition unit 11 acquires a plurality of adjustment data for the air conditioner 5 .

In step S<b>103 , the acquisition unit 11 acquires score statistics for each set of parameter values using the plurality of adjustment data acquired in step S<b>102 .

Through the series of processes shown in FIG. 10, the anomaly detection device 10 obtains the median score for each set of parameter values for use in adjusting target data, which will be described later.

FIG. 11 is a flowchart showing processing for generating and outputting abnormality information according to this embodiment.

As shown in FIG. 11 , in step S<b>201 , the acquisition unit 11 acquires target data, which is operation data of the air conditioner 5 .

In step S<b>202 , the detection unit 14 receives the target data obtained in step S<b>201 and obtains the target score, which is the score output by the model 16 .

In step S203, the detection unit 14 uses the target score acquired in step S202 and the median value of the set of parameter values associated with the target data acquired in step S201 to generate and output abnormality information. do. For example, the detection unit 14 generates an adjusted score by subtracting the median value from the target score, and outputs it as abnormality information.

Through the series of processes shown in FIG. 11, the abnormality detection device 10 generates and outputs abnormality information.

In this manner, the anomaly detection device 10 can appropriately perform anomaly detection while reducing the number of models to be generated.

(Modification)
In this modified example, an anomaly detection device that appropriately performs anomaly detection while suppressing the number of models to be generated uses operation data of the device over a plurality of consecutive periods to perform anomaly detection. explain.

The abnormality detection device 10 according to this modification has the same configuration as the abnormality detection device 10 according to the embodiment, but the detection processing performed by the detection unit 14 is different. A detection process performed by the detection unit 14 will be described.

FIG. 12 is an explanatory diagram showing the concept of calculation of integrated scores in a plurality of periods according to this modification.

The detection unit 14 in this modification acquires the adjusted score from the target score output by the model 16 with the target data as input, similarly to the detection unit 14 in the embodiment. The detection unit 14 inputs data D31, D32, and D33 as target data to the model 16 as operation data in each of a plurality of consecutive periods (for example, periods T1 and T2 shown in FIG. 4), thereby obtaining scores for each period. S31, S32 and S33 are obtained, and adjusted scores S41, S42 and S43 are obtained.

Thereafter, the detection unit 14 acquires an integrated score S5 by integrating the acquired adjusted scores S41, S42, and S43. The operation of integrating the adjusted scores S41, S42 and S43 is, for example, an operation of calculating the average value of the adjusted scores S41, S42 and S43. Note that, as the above calculation, a calculation that takes a median value or a mode value may be adopted.

The detection unit 14 uses the integrated score S5 thus obtained as the adjusted score in the above-described embodiment, and outputs it as abnormality information.

By doing so, the abnormality detection device 10 according to the present modification can execute the abnormality detection processing for the operation of the air conditioner 5 over a plurality of consecutive periods.

Note that discontinuous periods can also be used as the plurality of periods. That is, as the plurality of periods, the period T2 may be set after an appropriate time interval after the period T1, and the period T3 may be set after an appropriate time interval after the period T2.

As described above, in the anomaly detection methods of the embodiments and modifications, the statistical values of the second index output by the model are acquired in advance for each of a plurality of sets of parameter values, and then the operation input to the model is obtained. Anomaly information is generated by comparing the indicator of the third data, which is data, with the statistical value of the set of parameter values during operation of the device related to the third data. If a model were prepared for each set of parameter values, the number of required models would increase, and the processing and power consumption required to generate the models would also increase. In addition, if the statistical values of the second index output by the model are not used for each of a plurality of sets of parameter values, differences in operation data will occur due to different sets of parameter values. may not be able to generate information about the anomaly. According to the anomaly detection method of the present disclosure, the statistic value for the set of parameter values related to the third data, which is included in the statistic value of the second index for each of the plurality of sets of parameter values; Since the indices are used, a model for each set of parameter values is not required, and differences in operation data caused by different parameters can be suppressed. In this way, the anomaly detection method according to the present disclosure appropriately performs anomaly detection while reducing the number of models to be generated.

Further, by subtracting the statistical value from the third index, it is possible to suppress the difference in the operation data caused by the different sets of parameter values. Generates information to show Therefore, while suppressing the number of models to be generated, detection of anomalies can be performed more easily and appropriately.

In addition, by clustering a plurality of pieces of operation data for model generation, operation data indicating normal operation of the device is generated, and using the distance between the operation related to the input operation data and the normal operation in the data space, the input It outputs the degree of divergence from the normal motion of the motion related to the motion data obtained. Therefore, while suppressing the number of models to be generated, detection of anomalies can be performed more easily and appropriately.

Also, clustering processing is performed on the learning data by unsupervised learning. Therefore, while suppressing the number of models to be generated, unsupervised learning is used to more accurately and appropriately detect anomalies.

Further, since the operation data related to the operation of the device for a predetermined length of time is used as the operation data, the operation data can be handled and processed more easily. Therefore, while suppressing the number of models to be generated, detection of anomalies can be performed more easily and appropriately.

In addition, it is possible to acquire information about an abnormality in the device by considering operation data related to the operation of the device in a plurality of periods. As a result, it may be possible to discover an abnormality in the equipment that cannot be discovered from only the operation data in one period. Therefore, while suppressing the number of models to be generated, detection of anomalies can be performed more appropriately.

In addition, it is possible to acquire information about an abnormality in the device by considering operation data related to the operation of the device in a plurality of consecutive periods. As a result, it may be possible to discover an abnormality in the equipment that cannot be discovered from only the operation data in one period. Therefore, while suppressing the number of models to be generated, detection of anomalies can be performed more appropriately.

In addition, regarding the air conditioner, information indicating the time of operation, information indicating the operation mode, information indicating whether or not the setting of the operation has been changed, and information indicating the operating state of the compressor of the air conditioner are used to determine the operation of the air conditioner. Output information about anomalies. Therefore, the number of models to be generated is suppressed, and the abnormality of the air conditioner is appropriately detected.

As described above, the embodiment and the modified examples have been described as examples of the technology of the present disclosure. To that end, the accompanying drawings and detailed description have been provided.

Therefore, among the components described in the attached drawings and detailed description, there are not only components essential for solving the problem, but also components not essential for solving the problem in order to exemplify the above technology. can also be included. Therefore, it should not be determined that those non-essential components are essential just because they are described in the accompanying drawings and detailed description.

In addition, the above-described embodiments and modifications are intended to illustrate the technology of the present disclosure, and various changes, replacements, additions, omissions, etc. can be made within the scope of claims or equivalents thereof. .

INDUSTRIAL APPLICABILITY The present disclosure is applicable to an anomaly detection device that detects an anomaly in the operation of equipment.

1 anomaly detection system 5 air conditioner 7 presentation device 10 anomaly detection device 11 acquisition unit 12 generation unit 13 storage unit 14 detection unit 16 model 17 reference information C frame D1, D2, D3, D11, D12, D21, D22, D31, D32, D33 data N network S1, S2, S3, S11, S12, S21, S22, S31, S32, S33 score S4, S41, S42, S43 adjusted score S5 integrated score T1, T2, T3 period U user V maintainer

Claims (9)

Acquiring a model that receives as input first data indicating the operation of a device and outputs a first index indicating the degree to which the operation indicated by the first data deviates from normal operation,
A plurality of second data, each of which indicates an operation of the device and is associated with a set of parameter values of the device during the operation, is input and output by the model. Obtain the statistical value for each set of the second index obtained by
Acquiring third data indicating an operation of the device and associated with a set of parameter values of the device during the operation;
obtaining a third index output by the model using the obtained third data as input;
using a comparison of the obtained third indicator with the statistical value for the set of parameter values associated with the obtained third data to obtain information about the abnormality in the operation indicated by the third data; Anomaly detection method to generate and output. When comparing said third indicator with said statistic for said set of parameter values,
Determining whether a value obtained by subtracting the statistical value from the obtained third index is equal to or greater than a predetermined threshold;
When the value is determined to be equal to or greater than the predetermined threshold, generating the information including information indicating an abnormality,
The abnormality detection method according to claim 1, wherein the information including information indicating that there is no abnormality is generated when it is determined that the value is less than the predetermined threshold. When obtaining the model,
In a data space, among a plurality of pieces of learning data each including the operation of the device, clusters are generated that contain a predetermined proportion of mutually similar learning data, and the plurality of pieces of learning data included in the generated clusters are generated. The anomaly detection method according to claim 1 or 2, wherein the model is obtained by generating a model that outputs a distance from the center of gravity as the first index. When obtaining the model,
4. The anomaly detection method of claim 3, wherein generating the clusters using unsupervised learning is used to obtain the model. the first data indicates an operation of a predetermined length of time among the operations of the device;
each of the plurality of second data indicates the operation of the device for the predetermined length of time;
The anomaly detection method according to any one of claims 1 to 4, wherein the third data indicates the operation of the device for the predetermined length of time. the third data includes the third data in each of a plurality of periods each having the predetermined length of time;
Acquiring the third index for each of the plurality of third data, which is output by the model using each of the plurality of acquired third data as input;
Information about the abnormality in the operation indicated by the third data, using the obtained average value of the plurality of third indicators and the statistical value for the set of parameter values associated with the third data The anomaly detection method according to claim 5, which generates and outputs the . The anomaly detection method according to claim 6, wherein the plurality of periods are consecutive periods. The device is an air conditioner,
The parameter values include information indicating the timing of the operation, information indicating the mode of operation, information indicating whether or not the setting of the operation has been changed, and information indicating the operating state of the compressor of the air conditioner. The abnormality detection method according to any one of claims 1 to 7. An anomaly detection device comprising an acquisition unit, a generation unit, and a detection unit,
The acquiring unit acquires a model that receives first data indicating the operation of the device as input and outputs a first index indicating the degree to which the operation indicated by the first data deviates from normal operation,
The generating unit inputs each of a plurality of second data, each of which indicates an operation of the device and is associated with a set of parameter values of the device during the operation. Obtain the statistical value for each set of the second index output by the model as
The acquisition unit acquires third data indicating an operation of the device and associated with a set of parameter values of the device during the operation,
The detection unit is
obtaining a third index output by the model using the obtained third data as input;
using a comparison of the obtained third indicator with the statistical value for the set of parameter values associated with the obtained third data to obtain information about the abnormality in the operation indicated by the third data; Abnormality detection device that generates and outputs.

Images